Rare SMB Connection to the Internet

This detection identifies potentially malicious Server Message Block (SMB) traffic originating from internal networks and directed towards external IP addresses. The rule focuses on detecting unusual SMB communication patterns, particularly those initiated by the Windows System process (PID 4) on ports 139 and 445. Threat actors can abuse SMB to exfiltrate data or capture NTLM credentials through rogue UNC path injection. The rule aims to detect this activity by monitoring SMB traffic and filtering out connections to known internal IP ranges, highlighting potentially malicious SMB connections to external networks. The rule was last updated on 2026/04/07.

Attack Chain

1. The attacker compromises a Windows host within the internal network.
2. The attacker uses a rogue UNC path to inject a malicious SMB path.
3. The compromised host attempts to connect to an external IP address over SMB (ports 139 or 445), initiated by PID 4.
4. The SMB connection attempts to authenticate with the external server.
5. The attacker captures NTLM credentials if the external server is under their control.
6. Alternatively, the attacker may attempt to exfiltrate data via the SMB connection.
7. The destination IP, normally not a target for SMB traffic, receives the connection attempt.

Impact

Successful exploitation could lead to credential compromise through NTLM hash capture, potentially granting the attacker access to other systems within the network. Data exfiltration can result in the loss of sensitive information. The scope of impact depends on the permissions of the compromised account and the sensitivity of the exfiltrated data. The risk score of the original rule is 47.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect potential SMB exfiltration attempts.
• Investigate any alerts generated by the Sigma rules, focusing on the source host and destination IP addresses.
• Implement network segmentation to limit SMB traffic to only necessary internal communications, reducing the risk of external exposure, as described in the overview.
• Enhance monitoring and logging for SMB traffic, particularly for connections to external IPs, to detect and respond to future anomalies more effectively.
• Examine process with PID 4 for unusual activity on source host, as described in the Triage and Analysis section of the original rule.